1. Field of the Invention
The present invention relates generally to routers in computer networks, and more particularly to a method of increasing resolution of virtual router assignment.
2. Description of Related Art
Routers are used to forward IP traffic in computer networks. To prevent information leaks, an Internet service provider may need to segregate traffic of different customers, and an enterprise may want to segregate traffic of different groups. Virtual routing and forwarding (VRF) may be used for such traffic segregation. VRF is a technology which allows several virtual routers to exist in one Internet router and work simultaneously.
FIG. 1 illustrates a simplified example of a part of a computer network of an enterprise. The enterprise may have multiple groups, e.g., groups BLUE, RED and GREEN. As shown, the computer network may have a number of VLANs (virtual LANs), and each of the VLANs may be used for network traffic among hosts belonging to one group, e.g., a blue VLAN 101b for the group BLUE, a red VLAN 101r for the group RED, and a green VLAN 101g for the group GREEN. The blue VLAN 101b may have hosts 1b, 2b, 3b and 4b belonging to the group BLUE, the red VLAN 101r may have hosts 1r and 2r belonging to the group RED, and the green VLAN 101g may have hosts 1g and 2g belonging to the group GREEN. A router 102 may contain a number of virtual routers, e.g., virtual routers B, R and G. Each virtual router may be identified by a VRF-ID (a pointer to address spaces in a routing table), and may function according to its own routing table, thus separating traffic of different groups of the enterprise. The currently available technology makes VRF assignment at layer 2 of the Internet Protocol and identifies virtual routers with port, VLAN tag or MPLS (Multiprotocol Label Switching) tunnel interface of a packet.
An enterprise may want to further segregate traffic between hosts in one VLAN, and sometimes may want to allow a host in one group (or VLAN) to communicate with a host in another group (or VLAN). For example, in the computer network shown in FIG. 1, hosts 1b and 2b may be workstations, and hosts 3b and 4b may be IP phones. The enterprise may want to separate workstation traffic from IP phone traffic, separate the traffic of the group BLUE from the traffic of the group GREEN, but allow traffic between workstation hosts 1b and 2b in the group BLUE and hosts 1r and 2r in the group RED. Theoretically, the currently available technology may accomplish this by using a table to define the segregation policies between hosts pair by pair. But in practice, the table may increase greatly in size as the number of hosts in the VLANs increases. In addition, the table is not scalable and needs to be updated each time a host is added to one of the VLANs.